--- title: "Vermont privacy law: controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/vermont/controller-duties" source: "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Vermont Data Privacy and Online Surveillance Act # Vermont privacy law: controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must limit collection to what is reasonably necessary and proportionate to the disclosed purposes, need consent for material new purposes, and keep reasonable security. The privacy notice must include, among other things, the categories of data sold and of buyers, a statement on whether data is collected, used or sold to train large language models, and the date of the last update, and it must be linked from the home page. From 1 January 2028 controllers must honour opt-out preference signals for targeted advertising and sale. Data protection assessments and separate impact assessments for consequential profiling are required. ## Key points 1. Collection limited to what is reasonably necessary and proportionate to the disclosed purposes. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(1)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 2. Privacy notice must cover categories of data, purposes, how to exercise and appeal rights, data sold and categories of buyers, targeted advertising, a contact address, large language model training, and the month and year of the last update. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(c)(1)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 3. Notice must be linked from the home page with the word 'privacy', provided in each language the controller uses, and accessible to people with disabilities. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(c)(2)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 4. Opt-out link required, and opt-out preference signals for targeted advertising and sale must be honoured. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(d)(2)(B), (C)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 5. Data protection assessments for targeted advertising, sale, risky profiling and sensitive data. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415g(a)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 6. Impact assessments for any profiling used for legal or similarly significant decisions, with prescribed contents. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415g(c)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 7. Retroactive material changes to the notice require notice to affected consumers and a chance to withdraw consent. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(c)(3)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 8. Access responses must not disclose Social Security, ID, financial account, health insurance numbers, passwords, security answers or biometric data; the controller says instead that it holds them. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(e)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) ## Sources - [Act 145 (S.71) as enacted, 2025-2026 session](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Vermont statute](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) Reference material, not legal advice. ## Other topics for Vermont - [Applicability](https://dposchool.com/state-privacy-laws/state/vermont/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/vermont/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Vermont](https://dposchool.com/state-privacy-laws/state/vermont) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents